TI-2025-24910 Aliases CVE-2025-36605 GHSA-96c5-c255-v838

Cross-site scripting in Dell Unity

LOW 27CWE-79Published 2025-08-04 · Updated 2025-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00285 21st percentileScored 2026-11-07

Fix Fixed Unity (Dell): 5.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Unity	N/A to before 5.5.1	5.5.1	Patch available	CNA

Unity VendorDell Affected N/A to before 5.5.1 Fixed in 5.5.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:unity_operating_environment::::::::	before 5.5.1.0	Vulnerable	Dell

cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:* Versions before 5.5.1.0 Vulnerable ·Dell

Remediation

Fix · CNA Unity (Dell) Fixed in 5.5.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2025-08-04
Dell Unity — dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-securit…
4 records Highest priority Priority CRITICAL 1 CRITICAL, 3 LOW
Other records, highest priority first
- TI-2025-24909 OS command injection in Dell UnityPriority CRITICAL 86
- TI-2025-24912 OS command injection in Dell UnityPriority LOW 36
- TI-2025-24911 OS command injection in Dell UnityPriority LOW 36
Show all 4 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-36605
2026-10-03 Alias added: GHSA-96c5-c255-v838

References

Advisory 1

https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities

TI-2025-24909 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
TI-2025-16296 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
TI-2024-33087 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
TI-2025-18126 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.1
TI-2022-11638 Missing brute-force protection in Dell Unity CVSS 3.1CRITICAL 9.8
TI-2025-18125 OS command injection in Dell Unity CVSS 3.1HIGH 7.3

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences